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SYSTEMS AND METHODS FOR PROVIDING INSURANCE IN 
CONJUNCTION WITH A DATA PROTECTION SERVICE 

BACKGROUND OF THE INVENTION 

The invention provides business methods for providing insurance in 
conjunction with a data protection service. 

Business owners' insurance policies are insurance policies that protect 
business owners from various losses in connection with their businesses. 
Some business owners' insurance policies include provisions that protect the 
business owner in the event of business interruptions. According to these 
provisions, the business owner is typically compensated by the insurance 
company for losses that occur when the business owner is unable to operate 
his business due to some unforeseen contingency. This can include situations 
where data that is vital to the business owner is lost. A typical business 
owner insurance policy would compensate the business owner until the data 
could be recovered, reconstructed, or otherwise restored. Insurance 
companies have an interest in reducing or eliminating the time it takes 
insured business owners to replace lost data, since this can reduce the time 
over which the insurance company is required to pay for the business 
interruption. 

Losses suffered in recent terrorist attacks and natural disasters helped 
draw attention to the problems associated with conventional insurance for 
insuring against economic losses arising out of lost data. Many companies 
either had their own data back up systems or utilized a third entity data 
protection service. Remarkably, these companies were up and running only a 
few days after the attacks. To the extent that these businesses had business 
interruption insurance, their insurance companies were required to pay for 
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"business interruption" losses incurred during the few days that business was 
interrupted while setting up computer systems at alternative locations. By 
contrast, for other companies that were not protected by some form of data 
protection technology, insurance companies were required to pay for business 
losses incurred during a much longer time period while business was 
interrupted during restoration or reconstruction of data. 

Companies have a strong incentive to pay the premiums charged for 
"business interruption insurance." In many cases, though, the insured 
companies fail to take the steps necessary to protect their data such as 
entering into a contract with a data protection provider. Small businesses 
and individuals often cannot afford their own data protection technology, and 
fail to appreciate the importance of contracting with third parties that 
provide such data protection services. Many individuals and small business 
owners carry computer insurance that protects the insured's computer 
hardware and software in the event of damage or destruction. These types of 
insurance, though, do not cover the data, for example, that is stored in the 
hardware and utilized by the software. Thus, when data is lost and this loss 
interrupts business, the insurance companies may end up paying business 
interruption claims for a much longer period while data is restored or 
reconstructed. 

A need exists for improved systems and methods for providing 
insurance and data protection services to data owners. 

SUMMARY OF THE INVENTION 

A business method for providing insurance in conjunction with a data 
protection service includes the creation of an agreement between a first 
entity and a second entity under which the second entity agrees to provide 
data protection services for use by a third entity. An insurance agreement is 
also created, under which the first entity agrees to insure the third entity 
against losses caused by data loss experience by the third entity. The 
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insurance agreement preferably requires the third entity to use the second 
entity's data protection service, and recovery under the insurance agreement 
by the third entity may be made contingent upon this use. The insurance 
agreement may specify the type or level of services that the third entity is 
required to use. In some embodiments, the second entity provides a data 
backup service in which a backup copy of the third entity's data is created 
and maintained at a location controlled by the second entity. If the third 
entity suffers a data loss, a further copy of the data is generated from the 
backup copy. The first entity may pay the second entity for providing data 
protection services to the third entity. The first entity may, moreover, elect 
not to charge the third entity any special premium or additional charge for 
providing the data protection service, beyond the usual premium that the 
first entity would ordinarily charge for providing its insurance without the 
provision of the data protection services. 

The invention thus can provide a loss mitigation tool for an insurer 
that provides an insured with insurance against economic losses incurred due 
to a loss of data by the insured. An insurance agreement between the insurer 
and the insured can provide this insurance to the insured, and can further 
allow the insured to use a data protection service. The insurance agreement 
may require the insured to install, set up, and use the data protection service. 

An insurance system is thus provided which includes a data protection 
service provider, an insurer, and an insured that is insured by the insurer 
against losses arising out of the loss of the insured's data, and in which the 
insured is required to use a data protection service offered by the provider. 

In some embodiments, the insured is not charged for the data 
protection services, the service provider instead being compensated by the 
insurer. In other embodiments the insured purchases the data protection 
service directly from the provider, but the insurer discounts the premium it 
would ordinarily charge for insuring the insured against losses arising from 
loss of its data. In still other embodiments, the data protection service 
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provider may pay the insurer for requiring the use of its services, or the 
provider may agree to provide its services to the insurer's insured at a price 
that is discounted in comparison to what the provider would normally charge 
for services of that type. 

Although in many embodiments the insurance and the data protection 
services will be provided to the data owner by separate entities, the insurance 
and data protection services may in some embodiments be provided by one 
single entity provider. 

BRIEF DESCRIPTION OF DRAWINGS 

The following discussion may be best understood with reference to the 
various drawings, which form a part of this disclosure. 

FIG. 1 is a flow chart illustrating methods according to embodiments of 
the invention. 

FIG. 2 is a block diagram further illustrating the methods of FIG. 1. 
FIG. 3 is a flow chart illustrating methods according to alternative 
embodiments. 

FIG. 4 is a block diagram further illustrating the methods of FIG. 3. 
FIG. 5 is a block diagram that illustrates other alternative 
embodiments. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 

The invention is described here with reference to the accompanying 
drawings, in which preferred embodiments of the invention are shown. The 
invention may, however, be embodied in many different forms and should not 
be construed as limited to these examples. 

When an element such as a block or unit is shown in the figures 
connected to another element, it can be directly connected to the other 
element or intervening elements may also be present. Terms such as "entity" 
and "data protection service" can include one or more of the indicated element. 
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"Data" includes any information that has value to its owner. 
"Insurance" is a financial arrangement for redistributing the costs of 
unexpected losses according to a contract in which an insurer agrees to 
compensate an insured for those losses. A "loss" is an undesired, unplanned 
reduction in economic value. "Data loss" can include, for example, events in 
which no current copy of the data exists, or events in which only a partial but 
possibly or certainly corrupted copy of the data is available. 

A "data protection service" can include data protection tools and 
techniques for reproducing information. These can include functions such as 
copying data and maintaining backups of data at previous times and dates. 
Particular data protection services might include local data mirroring, remote 
data mirroring, operating-system-supported data object replication, or file-by- 
file data archiving, and these might be supplemented by virus scanning or 
other data protection services. Such data protection services may be provided 
at a single facility or at a plurality of facilities, locally at the data owner's site, 
or remotely at another location. 

The methods and systems described here can apply in situations where 
a first entity insures a third entity via an insurance agreement. The first 
entity may purchase a data protection service from a second entity for use by 
customers of the first entity. Insurance agreements according to these 
methods can provide insurance to the third entity and include, among other 
things, provisions for providing insurance to protect against economic losses 
arising out of the insured's loss of data. 

FIG. 1 is a flow chart illustrating one method according to the 
invention. Block 140 represents a contract between a first entity 110 and a 
second entity 120. This contract can include an agreement obligating the 
second entity to provide data protection services to a third entity 130. The 
second entity could, for example, create a backup copy of the third entity's 
data and retain it at the second entity's location. If the third entity's data is 
lost, the second entity can restore the data from the backup copy. The second 
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entity may provide an online data backup service in which the third entity's 
data is transmitted to a location controlled by the second entity over the 
Internet, a private network or similar means for copying and backup by the 
second entity. Virtual Backup, Inc. is a provider of such services. 

Block 150 represents an insurance agreement between the first entity 
110 and the third entity 130. The insurance agreement obligates the first 
entity 110 to insure the third entity against losses to the third entity's data or 
business interruption losses that arise from such data loss. The insurance 
agreement permits, and may require, the third entity to use the data 
protection service provided by the second entity 120. The insurance 
agreement might, for example, require the third entity to install, set up, and 
use the data protection services. Recovery under the policy can be made 
contingent, in whole or in part, on the third entity!s compliance with these 
requirements. If, for example, the third party fails to use or fails properly to 
cooperate in the use of the data protection services, then the third party's 
recovery under the policy might be eliminated or reduced. Block 160 
represents the second entity's provision of data protection services to protect 
the third entity's data. 

The first entity 110 insures the third entity 130 against losses arising 
from its loss of data. These losses can be mitigated or minimized where the 
second entity 120 is able to restore the third entity's data quickly and 
completely after any data loss. The first entity pays or otherwise 
compensates the second entity for its data protection services, but may elect 
not to charge the third entity any special or additional premium beyond those 
normally charged for business interruption coverage or other typical 
insurance. Including data protection services as part of the insurance 
agreement at no additional premium encourages the insured third entity to 
use the data protection services. This reduces the losses suffered by the third 
entity insured when data is lost, and thereby reduces the amount the first 
entity insurer must pay out as compensation for data loss and business 
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interruption claims. The third entity's use of the data protection services can 
be made a condition of the insurance policy. The first entity insurer will not 
make good the third entity's losses unless the third entity has used the 
second entity's data protection services as required. The first entity insurer 
can increase the likelihood that the third entity will use those services, and 
losses that might otherwise have occurred can be mitigated by the presence 
and use of the data protection service. 

The insurance contract between the first entity and the third entity 
may be a "stand-alone" insurance contract providing for protection against 
economic losses arising out a loss of the third entity's data. Loss mitigation 
provisions might also be incorporated into and sold along with other 
protections as part of a larger contract or set of contracts. Such provisions 
might be incorporated, for example, into a contract for "valuable papers" 
coverage that would protect the third entity from economic losses that might 
otherwise arise out of the loss of information stored in paper records as well 
as the computerized data that are the subject of the data protection methods 
described in this document. Such data protection provisions might also be 
incorporated into a company's general business insurance policy, in 
connection, for example, with the company's business interruption insurace 
provisions. 

Data protection insurance like that described in this document might 
be also be included in provisions for insurance such as director's and officer's 
(D&O) insurance. In the event of a claim against the directors or officers of a 
corporation, the provisions described here would ensure that critical records 
required to defend against that claim were available for that defense, and 
compensate the insured entity in the event they were not. Similar 
protections might be made available in connection with professional liability 
policies of the type commonly purchased by doctors, lawyers, and the like. 
The data protection provisions help to ensure that patient or client records 
are present and available to defend against claims, and if the data are not 



7 



available, to mitigate the harm that might arise out of the data's 
unavailability. 

Although in many embodiments the insurance and the data protection 
services will be provided to the data owner by separate entities, the insurance 
and data protection services may in other embodiments be provided by one 
single entity provider. 

FIG. 2 illustrates a loss mitigation system. The arrow extending from 
the first entity insurer 110 to the third entity insured 120 represents 
insurance provided by the first entity, and in particular, compensation paid 
by the first entity to the third entity for losses that arise from data loss. The 
arrow that extends back from the third entity insured to the first entity 
insurer represents the premium or other compensation paid by the insured in 
return for the insurance. 

The arrow extending from the second entity data protection service 120 
to the first entity insurer 110 represents the data protection service's 
agreement with the insurer to allow the third entity insured 130 to use the 
data protection service. In essence, the first entity insurer 110 purchases 
data protection services on behalf of its insured customers. This can be 
viewed as the purchase of a license for the benefit of the third entity insured, 
and this license is represented by the arrow from the second entity data 
protection service to the third entity insured. The first entity insurance 
provider 110 compensates the second entity 120 for providing the data 
protection service to the insured 130. This compensation is represented by 
the arrow from the first entity insurer to the data protection service. 

Significantly, there is no arrow in this figure from the third entity 
insured 130 to the second entity data protection service 120. The third entity 
does not make any separate payment to the data protection service for the 
use of its service. Provision of such services is part of the third entity's 
agreement with its insurer, and payment for the services is from the insurer 
to the service provider. 



8 



With conventional insurance plans, the insured may or may not 
purchase data protection services. Many insureds will forgo the extra 
expense of acquiring such services; others may cut costs by contracting with 
services of dubious quality or effectiveness. Even when an insured does 
purchase data protection services, the insured may not take all of the steps 
required - such as installing required software, using it as directed, or 
making backups at the recommended frequency - to use the service 
effectively. 

In the scheme described here, though, the insured 130 does not pay 
anything directly to the data protection service provider 120, and the insurer 
110 typically will not charge any additional or special premium in exchange 
for the insurer's arranging for the data protection service. The insured, 
moreover, can be required by the terms of the policy to cooperate with the 
service to install, maintain, and use the data protection service to provide the 
specified protection for the data. If the insured fails to do what is required, 
recovery may be denied by the insurer in the event of data loss. 

An insured thus has a very substantial incentive to maintain and use 
the data protection service. By increasing the number of insureds that use 
the data protection service, and by ensuring that the data protection service 
provides a service of acceptable quality, the insurance provider can expect to 
reduce the amounts it must pay out in claims for data loss and business 
interruption pursuant to the insurance agreement. 

FIGS. 3 and 4 illustrate a variant in which an "offset method" is 
utilized to pay for the data protection services. In this method, the first 
entity insurer 110 (see FIG. 3) provides insurance 145 to the third entity 
insured 130 for a premium that is reduced in comparison with the premium 
ordinarily charged for the same level of insurance. To qualify for the reduced 
premium, the third entity 130 must agree to purchase data protection 
services 160 - the agreement between the third entity insured and the second 
entity data protection service provider 120 being represented by block 155 in 
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FIG. 3. Though the third entity must pay the second entity for the data 
protection services, the third entity's expense in doing so can be offset by the 
reduced insurance premium charged by the first entity insurer. 

In FIG. 4, the arrow from the first entity insurer 110 to the third entity 
insured 130 represents the insurance provided by the insurer to the third 
entity. The arrow from the insured to the insurer represents the premium 
the third entity pays to purchase the insurance. This premium is reduced in 
comparison with what the insurer would normally have charged for the 
insurance. The reduced premium is typically offered on the condition that 
the third entity purchase data protection services from a second entity data 
protection service provider 120. The identity of the provider and the type and 
degree of data protection services may be specified in the insurance 
agreement. 

The purchase by the third entity insured 130 of data protection 
services from the data protection service provider 120 is illustrated in FIG. 4. 
The arrow from the second entity data protection service provider to the third 
entity insured represents the provision of the data protection services by the 
provider. The arrow from the insured to the service provider represents the 
insured's payment for those services. 

FIG. 5 illustrates another variant. This method includes the same 
elements as those of the variant illustrated in FIGS. 3 and 4. This variant, 
though, includes a further agreement between the first entity insurer 110 
and the second entity data protection service provider 120. In FIG. 5, the 
arrow from the first entity insurer to the second entity data protection service 
provider represents a promise by the insurer to include in its policies a 
provision requiring its insureds to purchase data protection services from 
that provider. The arrow from the service provider to the insurer represents 
a promise by the provider to pay the insurer money or other compensation for 
requiring use of the provider's services, or to provide its services to the 
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insurer's insured at a discount to what it would normally charge for the same 
level of service. 

While aspects of the invention have been described in terms of certain 
preferred embodiments, those of ordinary skill in the art will appreciate that 
various changes and additions might be made without varying from the basic 
principles of the invention. Aspects of the present invention can be 
implemented in a variety of implementations, and are not limited to any one 
particular implementation. Moreover, although the aspects of the invention 
described herein are described with reference to a first entity insurer, a 
second entity data protection service, and a third entity insured, the parties 
to the methods described here need not be formally denominated as such, so 
long as they act as described in the appended claims. The invention could 
also be embodied in insurance models in which other parties are present that 
act as brokers, agents, contractors, vendors, or other intermediaries in 
transactions between an insurer, an insured, and a data protection service 
provider. The inventions are thus not limited to the specific and exemplary 
embodiments described in this document. The scope of the invention should 
instead be determined from the appended claims, including the full scope of 
equivalents to which those claims are legally entitled. 
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